Living Online / web team

Form spam: the options.

HoneypotAlready onFree

A hidden field bots fill and humans never see.

ProsInvisible, zero false positives, already enabled.
ConsOnly stops basic bots.
Cloudflare TurnstileFree

Invisible bot check, usually no puzzle. One Living Online account, one key per domain.

ProsFree with no cap, low friction, privacy friendly, fails gently.
ConsOne key to add per site.
reCAPTCHA v3 / hCaptchaFree

Score-based checks. Same job as Turnstile.

ProsTunable score, free at our volumes.
ConsreCAPTCHA shares data with Google, strict settings re-create false positives.
CleanTalk~$150/yr, all sites

Cloud filter that reads the message and marks spam. No puzzle. One agency licence.

ProsCatches smart bots the gates miss, cheap at scale, invisible.
ConsSubmissions are checked against its cloud.
Akismet~$9.95/mo per site

Strong content filter, but client sites need the commercial licence.

ProsAccurate, marks rather than blocks.
ConsAbout $5,000/yr across 45 sites for what CleanTalk does cheaper.
Cloudflare Bot Fight / WAFFree tier

Blocks bad traffic before it reaches the site.

ProsStops bots at the door, protects the whole site.
ConsDo not geo-block, some sites get real overseas leads.
AI triage (n8n)~$0 to $20/mo

Not a blocker. Rescues real leads stuck in spam, and keeps spam out of the client's inbox.

ProsRecovers leads and cleans the inbox. Cannot block a lead.
ConsHosted AI needs a paid key, self-hosting is free but needs setup.

Honeypot

How it works

A hidden field humans never see and bots fill in. Filled means spam. Invisible, with effectively zero false positives.

Setup

  1. Open a form, go to Settings → Form Options.
  2. Turn on Anti-spam honeypot. Save.
  3. Already enabled across the sites.

Sources

Cloudflare Turnstile

How it works

An invisible check that runs on page load and validates on submit. Usually no puzzle. Replaces Zero Spam and fails gently instead of hard-blocking.

Setup

  1. In the one Living Online Cloudflare account, open Turnstile and add a widget for the client's domain. Copy the Site Key and Secret Key.
  2. In WordPress: Forms → Settings → CAPTCHA (Gravity Forms 2.9+ has Turnstile; older installs use the add-on). Paste the keys.
  3. Add the CAPTCHA field to each form.
  4. Run it in managed / invisible mode, not "always challenge". Send a test entry.

Sources

reCAPTCHA v3 / hCaptcha

How it works

Token checks, same job as Turnstile. reCAPTCHA v3 gives a 0 to 1 score you can tune. Use only one of the three.

Setup

  1. Register the site at the Google reCAPTCHA admin or hCaptcha dashboard. Copy the keys.
  2. In WordPress: Forms → Settings → reCAPTCHA, paste the keys, pick v3.
  3. Add the CAPTCHA field. For v3, set a lenient score so real people are not blocked.

Sources

CleanTalk

How it works

Reads the actual message and marks spam. No puzzle. One agency licence covers every site.

Setup

  1. Buy the agency / multisite licence at cleantalk.org and copy the Access Key.
  2. Install Anti-Spam by CleanTalk on each site, paste the key, enable Gravity Forms protection.
  3. Set it to flag as spam (move to Spam folder), not hard reject. Send a real-looking test.

Sources

Akismet

How it works

Content filter that marks spam, does not block. Accurate, but client sites need the paid licence, costly at our scale.

Setup

  1. Install the Akismet plugin, enter a commercial API key.
  2. Enable the Akismet integration in the form settings.

Sources

Cloudflare Bot Fight / WAF

How it works

Blocks bad traffic before it reaches WordPress. Whole-site, not just forms. Needs the site's DNS on Cloudflare.

Setup

  1. Point the site's DNS through Cloudflare (proxied).
  2. In Security → Bots, turn on Bot Fight Mode.
  3. Optionally add a WAF rate-limit rule on the form endpoint. Do not geo-block, some sites get real overseas leads.

Sources

AI triage via n8n

How it works

Runs after a submission saves, never in front of the visitor. It does two jobs:

Rescue leads: reads the spam folder, alerts staff when something is a real enquiry.

Clean inbox: the client's notification goes through n8n first, which emails only the real ones and marks the rest as spam. No spam email reaches the client.

Free self-hosted: Ollama on the VPS with a small model (llama3.2:3b or gemma2:2b). The server has spare memory and idle CPU, so a background check every few seconds is fine.

Setup

  1. Install Ollama on the VPS: ollama pull llama3.2:3b. Cap its memory in Dokploy.
  2. Route notifications through n8n: turn off the form's direct client email, send the entry to n8n with a webhook.
  3. n8n asks the model "is this a genuine enquiry, yes or no". If yes, it emails the client. If no, it leaves it in spam and can mark the entry as spam.
  4. Also point n8n at the Spam folder so slipped-through real enquiries get flagged too.

Sources